THREATNOIR
Subscribe
Back to advisories

August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day

Microsoft patched CVE-2026-68820, a zero-day use-after-free in afd.sys kernel driver actively exploited for SYSTEM privilege escalation. This is the fourth afd.sys zero-day since 2022, with historical links to nation-state actors. All Windows systems running unpatched afd.sys are at immediate risk of local privilege escalation.

CRITICALAdvisoryAug 12, 2026
Action required
Prioritize patching CVE-2026-68820 (afd.sys) on all Windows endpoints. Hunt for exploitation attempts by searching for unexpected afd.sys process interactions, kernel crashes, and lateral movement from standard user accounts to SYSTEM.
Affected products
afd.sysWindows Sockets APIWindows User Profile ServiceWindows Container Isolation FS Filter DriverWindows DNS server
CVE IDs
CVE-2026-68820
Linked articles
Source links